--- analysis: A simple vulnerability alert does not indicate if exploitation has occurred; this hunt correlates the presence of the software with the behavioral signals of script drops and rare shell execution to distinguish unpatched systems from active compromises. blind_spots: - id: no-appliance-telemetry question: Whether the appliance was compromised but did not report file or process activity requires: Endpoint telemetry on the appliance OS risk: A closed appliance without an agent will not report the behavioral activity this hunt relies on, leading to a false negative. stage: execution-unauthorized-scripts - id: no-http-logs question: The specific exploit path used for the authentication bypass requires: hb_http_activity or appliance web logs risk: Without HTTP-level logs, the initial bypass is only visible via its behavioral aftermath (files and processes). stage: initial-access-beyondtrust-bypass coverage: - stage: initial-access-beyondtrust-bypass status: covered steps: - identify-affected-appliances - unrecognized-script-creation - stage: execution-unauthorized-scripts status: covered steps: - rare-shell-execution - unrecognized-script-creation - reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series. stage: persistence-account-manipulation status: out_of_scope - reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series. stage: lateral-movement-privileged-sessions status: out_of_scope - reason: Belongs to another part of the 'CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support' series. stage: defense-evasion-log-tampering status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: BeyondTrust CVE-2026-102764 is a critical authentication bypass in the CISA KEV catalog. Compromised appliances provide attackers with persistent, privileged remote access to the internal network. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited CVE-2026-102764 to bypass authentication on a BeyondTrust Remote Support appliance, resulting in unauthorized file operations and the execution of unrecognized scripts. labels: - hunt - attack.t1190 - attack.t1059 - defense evasion - execution - initial access - lateral movement - persistence name: BeyondTrust Appliance Compromise and Execution parameters: lookback_days: default: '14' description: Days of history to examine for behavioral activity. type: number scope_hosts: default: [] description: List of hostnames of suspected appliances to narrow the search; leave empty to hunt across the entire estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on self-hosted BeyondTrust/Bomgar appliances. Use software inventory to find these devices regardless of whether they have an active vulnerability finding, as the bypass is widely exploited. references: - name: "CISA \u2014 CISA Urges Patching Critical Vulnerability in BeyondTrust Remote\ \ Support" url: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support related: - hunt: beyondtrust-persistence-manipulation reason: This hunt focuses on initial access and script execution; persistence through session-policy changes is handled elsewhere. relation: out-of-scope-alternative scenario: stages: - name: BeyondTrust Remote Support Authentication Bypass observables: - BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier - CVE-2026-102764 - Unauthorized file operations on the B Series appliance slug: initial-access-beyondtrust-bypass tactic: initial-access techniques: - T1190 - name: Execution of Unrecognized Scripts observables: - Unrecognized script files on the appliance slug: execution-unauthorized-scripts tactic: execution techniques: - T1059 - name: Account and MFA Manipulation observables: - Unauthorized account changes - Permission or session-policy modifications - New MFA registrations on privileged accounts slug: persistence-account-manipulation tactic: persistence techniques: - T1098 - T1556.006 - name: Unrecognized Privileged Sessions observables: - Unrecognized privileged or administrative sessions slug: lateral-movement-privileged-sessions tactic: lateral-movement techniques: - T1078 - T1021 - name: Detection Evasion via Log Tampering observables: - Unexpected gaps in logs - Unexpected gaps in log forwarding slug: defense-evasion-log-tampering tactic: defense-evasion techniques: - T1562.002 summary: Threat actors are exploiting a critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) to gain initial access and perform unauthorized file operations on vulnerable appliances. Post-exploitation, attackers execute unauthorized scripts, establish persistence through account and MFA manipulation, and move laterally using unrecognized privileged sessions while tampering with log forwarding to evade detection. series: index: 1 slug: cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support title: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support total: 2 severity: critical targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # BeyondTrust Appliance Compromise and Execution This hunt targets the exploitation of BeyondTrust Remote Support (formerly Bomgar) appliances. It first identifies affected appliances in the estate, then fans out to search for the outcomes of the authentication bypass: the creation of unrecognized script files and the execution of rare shells or interpreters. By combining inventory scoping with behavioral activity, the hunt identifies compromised appliances even when network-level exploitation logs are missing. ## identify-affected-appliances Use software inventory to find these devices regardless of whether they have an active vulnerability finding, to define the search scope. ```sqlite target=endpoint role=scoping ~~~yaml expected: Silence means no matching software packages are found in the inventory. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%beyondtrust%' OR LOWER(package_name) LIKE '%bomgar%' ``` ## corroborate-activity parallel: - → rare-shell-execution - → unrecognized-script-creation join: → triage-exploitation ## rare-shell-execution The query stack-counts the execution of shells and interpreters on appliances so that one-host sessions stand out from fleet-wide activity. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A shell or interpreter path seen on very few hosts. Silence suggests no unusual shell sessions occurred during the window. prevalence: by: device_hostname key: - process_path rare_below: 3 reads: - process_path - device_hostname - time - on_disk silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-17' ~~~ SELECT LOWER(process_path) AS shell_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (on_disk = 0 OR (LOWER(process_path) LIKE '%/sh' OR LOWER(process_path) LIKE '%/bash' OR LOWER(process_path) LIKE '%/python%' OR LOWER(process_path) LIKE '%/perl' OR LOWER(process_path) LIKE '%/php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY shell_path HAVING host_count <= 3 ORDER BY host_count ASC, run_count ASC ``` ## unrecognized-script-creation Find scripts dropped during exploitation. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Silence means no script creation was recorded. reads: - device_hostname - file_path - process_name - actor_user_name - time - activity_id silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%.py' OR LOWER(file_path) LIKE '%.pl' OR LOWER(file_path) LIKE '%.php') AND (LOWER(file_path) LIKE '/tmp/%' OR LOWER(file_path) LIKE '/var/tmp/%' OR LOWER(file_path) LIKE '/dev/shm/%' OR LOWER(file_path) LIKE '%/www/%' OR LOWER(file_path) LIKE '%/html/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-exploitation ```agent target=hunter cite: required context: - identify-affected-appliances - rare-shell-execution - unrecognized-script-creation max_iterations: 4 objective: Determine if any BeyondTrust appliance shows signs of active exploitation based on script drops and rare shell execution. success_criteria: A verdict of malicious | suspicious | benign per host, citing specific scripts or process rows. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-appliance indeterminate: → manual-forensic-review unavailable: → manual-forensic-review (blind_spot: no-appliance-telemetry) else: → close-out ## isolate-appliance ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified appliance host. Revoke all active support sessions and rotate credentials. ``` → manual-forensic-review ## manual-forensic-review ```manual target=analyst Review appliance syslog and web logs if available. Examine the dropped scripts and their contents to understand the attacker's intent. ``` → close-out ## close-out ```manual target=analyst Document the hosts examined, the presence of vulnerable software, and any suspicious file or process activity found. ``` → end